Merge commit 'cd4663dc80323ba64989d0c103d51ad3ee0e9c2f'

* commit 'cd4663dc80323ba64989d0c103d51ad3ee0e9c2f':
  smacker: add sanity check for length in smacker_decode_tree()

See b829da363985cb2f80130bba304cc29a632f6446

Merged-by: James Almer <jamrial@gmail.com>

diff --cc libavcodec/smacker.c
index dad899c79179e3137681ef722482fe157087b2c4,7deccffa5497265c66d1ee5ed8acf04bacfee575..2077dde4a1803bbc5b5d20357a73f26553d3a022
--- 1/libavcodec/smacker.c
--- 2/libavcodec/smacker.c
+++ b/libavcodec/smacker.c
@@@ -42,7 -42,8 +42,8 @@@
  
  #define SMKTREE_BITS 9
  #define SMK_NODE 0x80000000
 +
+ #define SMKTREE_DECODE_MAX_RECURSION 32
  
  typedef struct SmackVContext {
      AVCodecContext *avctx;
@@@ -93,14 -94,16 +94,15 @@@ enum SmkBlockTypes 
  /**
   * Decode local frame tree
   */
 -static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc,
 -                               uint32_t prefix, int length)
 +static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t prefix, int length)
  {
-     if(length > 32 || length > 3*SMKTREE_BITS) {
-         av_log(NULL, AV_LOG_ERROR, "length too long\n");
 -    if (length > SMKTREE_DECODE_MAX_RECURSION) {
++    if (length > SMKTREE_DECODE_MAX_RECURSION || length > 3 * SMKTREE_BITS) {
+         av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
          return AVERROR_INVALIDDATA;
      }
 -    if (!bitstream_read_bit(bc)) { // Leaf
 -        if(hc->current >= 256){
+ 
 +    if(!get_bits1(gb)){ //Leaf
 +        if(hc->current >= hc->length){
              av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");
              return AVERROR_INVALIDDATA;
          }